---
id: CVE-2026-98110
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: btintel: bound firmware ID by TLV length

  The firmware ID is treated as a NUL-terminated string even though the
  TLV length is its only boundary
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: btintel: bound firmware ID by TLV length

  The firmware ID is treated as a NUL-terminated string even though the
  TLV length is its only boundary. If the value…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 164c62f958f8c7f0bde1e9a5a8677971c6f28205 <
    aef56a2bd5aa22808ce508605d7497d2b5e8eb5f
  - >-
    Linux >= 164c62f958f8c7f0bde1e9a5a8677971c6f28205 <
    058f56de5f48ba4b3be01526006ac83ce9e79f39
  - >-
    Linux >= 164c62f958f8c7f0bde1e9a5a8677971c6f28205 <
    a07b3024a927892dd46e7dfbed438e8834e24098
  - >-
    Linux >= 164c62f958f8c7f0bde1e9a5a8677971c6f28205 <
    ac8aa9e0ec93a12a60230066f199f49c3b9aac3d
  - Linux 6.11
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:42.113'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98110'
references:
  - url: 'https://git.kernel.org/stable/c/058f56de5f48ba4b3be01526006ac83ce9e79f39'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a07b3024a927892dd46e7dfbed438e8834e24098'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ac8aa9e0ec93a12a60230066f199f49c3b9aac3d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/aef56a2bd5aa22808ce508605d7497d2b5e8eb5f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.822Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: bound firmware ID by TLV length

The firmware ID is treated as a NUL-terminated string even though the
TLV length is its only boundary. If the value does not contain a NUL
terminator, snprintf() can read beyond the received response.

Limit the conversion to the advertised TLV value length.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.